Can you post the full message in a text attachment; including the MIME information. Will run through my install and see what it hits. A similar one I received today got the following scores
Code:
cached not
score=57.1
6 required
autolearn=spam
3.00 AV_SS SaneSecurity Signatures
3.50 BAYES_99 Bayesian spam probability is 99 to 100%
1.00 BOTNET Relay might be a spambot or virusbot
0.50 BOTNET_CLIENT Relay has a client-like hostname
0.50 BOTNET_CLIENTWORDS Hostname contains client-like substrings
0.50 BOTNET_IPINHOSTNAME Hostname contains its own IP address
2.17 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
0.00 DIGEST_MULTIPLE Message hits more than one network digest check
4.39 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2)
3.49 HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP)
1.55 HTML_IMAGE_ONLY_20 HTML: images with 1600-2000 bytes of words
0.38 HTML_IMAGE_RATIO_02 HTML has a low ratio of text to image area
0.00 HTML_MESSAGE HTML included in message
0.00 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
4.00 JM_SOUGHT_1
1.46 MIME_HTML_ONLY Message only has text/html MIME parts
3.70 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
0.50 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
1.50 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level above 50%
0.50 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
3.00 RCVD_IN_BRBL Received via relay listed in Barracuda RBL
0.91 RCVD_IN_PBL Received via a relay in Spamhaus PBL
0.88 RCVD_IN_SORBS_DUL SORBS: sent directly from dynamic IP address
1.00 RCVD_IN_SPAMRATS_DYNA Sender listed in SpamRats DYNA
2.07 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.10 RDNS_DYNAMIC Delivered to trusted network by host with dynamic-looking rDNS
1.67 SARE_FROM_DRUGS
0.59 SARE_UNI
1.93 TVD_RCVD_IP
1.86 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
1.96 URIBL_BLACK Contains an URL listed in the URIBL blacklist
4.00 URIBL_IVMURI Contains a URL listed on ivmURI found at invaluement.com
1.50 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
1.50 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
1.50 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
Bugzilla
Wiki
Source
Linear Mode
